CSA (312-39) SOC Simulation Lab

Welcome to the Threat Detection Lab. In this simulation, you'll analyze how modern Security Operations Centers (SOCs) leverage machine learning to hunt "living off the land" attacks and compromised credentials that bypass standard alerting.

Scenario Context

You are a Tier 3 Incident Responder. Over the past week, threat actors have compromised valid employee credentials. They are not using malware, and they are logging in during normal business hours from typical geographies. Your standard SIEM alerts (Impossible Travel, >5 Failed Logins, Mimikatz Execution) have not triggered.

To detect these adversaries, you pivot away from static thresholds and review the telemetry generated by the newly integrated User and Entity Behavior Analytics (UEBA) module.

Security Environment

Review the following JSON output generated by the SIEM's UEBA correlation engine.

{ "time": "2024-05-12T14:22:01Z", "sourcetype": "ueba_engine_alert", "user": "j.doe", "department": "Marketing", "event_name": "Atypical Resource Access", "risk_score": 88, "analytics_model": "peer_group_deviation", "details": { "accessed_resource": "AWS_S3_Customer_PII_Prod", "historical_access_count": 0, "peer_group_probability": 0.01 }, "mitre_tactic": "Collection (TA0009)" }

* Note: The system didn't flag the event because downloading a file is inherently malicious. It flagged it because it deviates from mathematical norms for this entity.

Question 25

Which of the following event detection techniques uses User and Entity Behavior Analytics (UEBA)?

SOC Hint: Rule and signature detections look for "known bad" (like malware hashes or exact if/then conditions). UEBA uses ML to build a baseline of "known good" and flags deviations from that baseline. What is another word for a deviation from the norm?

🛡️ Expert Insight: Tier 3 Analysis

What is happening: A threat actor successfully authenticated as an employee (j.doe). Because they authenticated cleanly, rule-based alerts failed. However, the UEBA engine noticed that a Marketing employee is suddenly interacting with an S3 bucket containing production PII—a drastic deviation from both the user's historical baseline and their peer group's typical behavior.

Why C is correct: UEBA is the primary tool used for Anomaly-based detection. It ingests massive amounts of logs to establish a statistical baseline of normal behavior for users and devices (entities). When an action occurs outside of these mathematical bounds (an anomaly), it raises a risk score.

Why other options are wrong:

Rule-based (A): Relies on hard-coded boolean logic (e.g., IF Login_Fails > 5 THEN Alert). It cannot dynamically adapt to user baseline shifts.
Heuristic-based (B): Uses "rules of thumb" or algorithmic behavioral logic, often used in AV to detect malware families without exact signatures. While advanced, it isn't strictly synonymous with the baseline-deviance model of UEBA.
Signature-based (D): Looks for exact matches of known-bad indicators (IOCs) like file hashes, IPs, or specific byte sequences. It is blind to insider threats using legitimate tools.

Real-world SOC application: In a modern SOC using tools like Microsoft Sentinel or Splunk Enterprise Security, UEBA is critical for detecting compromised credentials, insider threats, and lateral movement. The actions taken during these attacks (e.g., using RDP, accessing a file share) are administrative and look completely normal to signature and rule-based systems.

Mini Lesson: The Detection Engineering Pyramid

A mature SOC builds defense in depth across three distinct detection paradigms:

Signatures: (Fast/Rigid) Stops the commodity malware. E.g., YARA rules, known bad IP blocks.
Rules/Thresholds: (Medium/Flexible) Detects known attack patterns. E.g., "5 failed logins followed by 1 success".
Anomalies/UEBA: (Slow/Adaptive) Catches the advanced human adversary by measuring deviations from "normal" baselines.

Ready to validate more SOC detection and response concepts?

Explore more CSA simulations →